CTFtime.org / School CTF 2016 / (PRO 3) File Uploader / Writeup

Try to upload file some file with `debug=1` parametr (Uncomment line in html)
We see `Parsing docx error`
Create empty docx file, name him `test.docx`
Open docx file with 7-zip
Open `[Content_Types].xml`, this`s xml file
When you see xml file, you should think `Hmm, may be XXE vulnerability?`
Now, use google for search all about XXE (XML ENTITY) (https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing)
Try to watch file `/var/www/html/index.php` with SYSTEM ENTITY AND PHP I/O and XXE vuln
Inject in script your ENTITY (Change `yoursite` to url to your site (or link to file on file hosting))
Update Content Type file in 7-zip
Create xxe.txt in root directory of your site and put into them this code:
Upload file.
Fine! You`re watch errors... Open Page Source Code (Ctrl + U)
You`ll see errors
Decode base64 from this error (From `http://?` to ` in <b>`)
You got php code when you can watch flag named file `flaflaflag.php`
Change in xxe.txt `/var/www/html/index.php` to `/var/www/html/flaflaflag.php` and update them on your site (or file hosting)
Upload your docx again
Decode base64 again
You`re great!

(PRO 3) File Uploader